anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary anacrolix/torrent's bencode decoder (`bencode/`) applies no limit on the nesting depth of nested dictionaries and lists. Two distinct denial-of-service mechanisms follow from that single root cause, both reachable from a single crafted `.torrent` file or from metadata obtained from a peer on a magnet-link/v2 download: 1. Stack-overflow process crash. `Decoder.readOneValue` recurses once per nesting level with no depth bound. A `.torrent` whose `info` value is a list nested a few million levels deep (≈8 MB file) drives the recursion past the 1 GiB goroutine-stack limit and the process dies with an unrecoverable `fatal error: stack overflow`. 2. Quadratic CPU exhaustion. `metainfo.FileTree.UnmarshalBencode` (BitTorrent v2) re-parses each subtree at every level, making parse time grow ~O(n²). A v2 info dict with a ~30,000-level file tree (≈0.2 MB) takes ~66 s to decode; 60,000 levels exceeds 90 s of decode time. Affected: every application embedding…

Published by the source

30 Oct 2026, 22:55 UTC

Last modified by the source

30 Oct 2026, 23:15 UTC

Source last checked

31 Oct 2026, 06:45 UTC

1. Revision 2 · amended · 31 Oct 2026

   Amended from osv record GHSA-2wrx-84qj-4pcg

2. Revision 1 · created · 30 Oct 2026

   Published from ghsa record GHSA-2wrx-84qj-4pcg

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-2wrx-84qj-4pcg

Advisory: anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS
IDs: GHSA-2wrx-84qj-4pcg
Record: https://patchnext.com/advisories/ghsa-2wrx-84qj-4pcg (revision 2, source checked 31 Oct 2026, 06:45 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/anacrolix/torrent 1.61.1-0.20260911233437-76452a2c8a2f. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/anacrolix/torrent: affected < 1.61.1-0.20260911233437-76452a2c8a2f; fixed in 1.61.1-0.20260911233437-76452a2c8a2f

## Suggested inspection (read-only)
- Go github.com/anacrolix/torrent: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/anacrolix/torrent.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-2wrx-84qj-4pcg (GitHub-reviewed advisory GHSA-2wrx-84qj-4pcg lists affected ranges: Go github.com/anacrolix/torrent >=0 <1.61.1-0.20260911233437-76452a2c8a2f)
- Verified: https://osv.dev/vulnerability/GHSA-2wrx-84qj-4pcg (OSV record GHSA-2wrx-84qj-4pcg lists affected ranges: Go github.com/anacrolix/torrent >=0 <1.61.1-0.20260911233437-76452a2c8a2f (fixed))

Commands are suggestions: review each one before running it.